X-Git-Url: http://git.polytechnique.org/?a=blobdiff_plain;f=modules%2Fprofile.php;h=5b7839beff267410c7a3d43d988fb64a8049b6c4;hb=f3df6d384c72871c814d607cd9122eba03666543;hp=69318cb79a96f6d1947e99cab9887e3d2592c2c2;hpb=34ca204875b2ac19495c9f23844e02145a56824a;p=platal.git

diff --git a/modules/profile.php b/modules/profile.php
index 69318cb..5b7839b 100644
--- a/modules/profile.php
+++ b/modules/profile.php
@@ -125,6 +125,7 @@ class ProfileModule extends PLModule
 
     function handler_photo_change(&$page)
     {
+        global $globals;
         $page->changeTpl('profile/trombino.tpl');
 
         require_once('validations.inc.php');
@@ -133,6 +134,8 @@ class ProfileModule extends PLModule
                     .'/'.S::v('forlife').'.jpg';
 
         if (Env::has('upload')) {
+            S::assert_xsrf_token();
+
             $upload = new PlUpload(S::v('forlife'), 'photo');
             if (!$upload->upload($_FILES['userfile']) && !$upload->download(Env::v('photo'))) {
                 $page->trigError('Une erreur est survenue lors du téléchargement du fichier');
@@ -143,6 +146,8 @@ class ProfileModule extends PLModule
                 }
             }
         } elseif (Env::has('trombi')) {
+            S::assert_xsrf_token();
+
             $upload = new PlUpload(S::v('forlife'), 'photo');
             if ($upload->copyFrom($trombi_x)) {
                 $myphoto = new PhotoReq(S::v('uid'), $upload);
@@ -152,18 +157,22 @@ class ProfileModule extends PLModule
                 }
             }
         } elseif (Env::v('suppr')) {
+            S::assert_xsrf_token();
+
             XDB::execute('DELETE FROM  photo
                                 WHERE  uid = {?}',
                          S::v('uid'));
             XDB::execute('DELETE FROM  requests
                                 WHERE  user_id = {?} AND type="photo"',
                          S::v('uid'));
-            update_NbValid();
+            $globals->updateNbValid();
         } elseif (Env::v('cancel')) {
+            S::assert_xsrf_token();
+
             $sql = XDB::query('DELETE FROM  requests
                                      WHERE  user_id={?} AND type="photo"',
                               S::v('uid'));
-            update_NbValid();
+            $globals->updateNbValid();
         }
 
         $sql = XDB::query('SELECT  COUNT(*)
@@ -213,11 +222,11 @@ class ProfileModule extends PLModule
         }
 
         if (S::logged()) {
-            $_SESSION['log']->log('view_profile', $login->login());
+            S::logger()->log('view_profile', $login->login());
         }
 
         $title = $user['prenom'] . ' ' . ( empty($user['nom_usage']) ? $user['nom'] : $user['nom_usage'] );
-        $page->assign('xorg_title', $title);
+        $page->setTitle($title);
 
         // photo
 
@@ -256,7 +265,7 @@ class ProfileModule extends PLModule
              INNER JOIN auth_user_quick  ON ( user_id = {?} AND emails_alias_pub = 'public' )
                   WHERE ( redirect={?} OR redirect={?} )
                         AND alias LIKE '%@{$globals->mail->alias_dom}'",
-                S::v('uid'),
+                $user['user_id'],
                 $user['forlife'].'@'.$globals->mail->domain,
                 $user['forlife'].'@'.$globals->mail->domain2);
         $page->assign('virtualalias', $res->fetchOneCell());
@@ -303,8 +312,8 @@ class ProfileModule extends PLModule
         $page->addJsLink('grades.js');
         $page->addJsLink('profile.js');
         $page->addJsLink('jquery.autocomplete.js');
-        $wiz = new PlWizard('Profil', 'core/plwizard.tpl', true, true);
-        require_once dirname(__FILE__) . '/profile/page.inc.php';
+        $wiz = new PlWizard('Profil', PlPage::getCoreTpl('plwizard.tpl'), true, true);
+        $this->load('page.inc.php');
         $wiz->addPage('ProfileGeneral', 'Général', 'general');
         $wiz->addPage('ProfileAddresses', 'Adresses personnelles', 'adresses');
         $wiz->addPage('ProfileGroups', 'Groupes X - Binets', 'poly');
@@ -323,7 +332,7 @@ class ProfileModule extends PLModule
                       . " la procédure de récupération de mot de passe si un jour tu le perdais");
         }
 
-       $page->assign('xorg_title', 'Polytechnique.org - Mon Profil');
+       $page->setTitle('Mon Profil');
     }
 
     function handler_applis_js(&$page)
@@ -442,7 +451,6 @@ class ProfileModule extends PLModule
         $page->changeTpl('profile/orange.tpl');
 
         require_once 'validations.inc.php';
-        require_once 'xorg.misc.inc.php';
 
         $res = XDB::query(
                 "SELECT  u.promo, u.promo_sortie
@@ -455,6 +463,8 @@ class ProfileModule extends PLModule
 
         if (!Env::has('promo_sortie')) {
             return;
+        } else {
+            S::assert_xsrf_token();
         }
 
         $promo_sortie = Env::i('promo_sortie');
@@ -553,9 +563,10 @@ class ProfileModule extends PLModule
 
     function handler_ref_search(&$page, $action = null, $subaction = null)
     {
-        require_once 'wiki.inc.php';
-        wiki_require_page('Docs.Emploi');
-        $page->assign('xorg_title', 'Polytechnique.org - Conseil Pro');
+        $wp = new PlWikiPage('Docs.Emploi');
+        $wp->buildCache();
+
+        $page->setTitle('Conseil Pro');
 
         //recuperation des noms de secteurs
         $res = XDB::iterRow("SELECT id, label FROM emploi_secteur");
@@ -639,7 +650,6 @@ class ProfileModule extends PLModule
         $page->changeTpl('profile/nomusage.tpl');
 
         require_once 'validations.inc.php';
-        require_once 'xorg.misc.inc.php';
 
         $res = XDB::query(
                 "SELECT  u.nom, u.nom_usage, u.flags, e.alias
@@ -649,7 +659,7 @@ class ProfileModule extends PLModule
                   WHERE  user_id={?}", S::v('uid'));
 
         list($nom, $usage_old, $flags, $alias_old) = $res->fetchOneRow();
-        $flags = new flagset($flags);
+        $flags = new PlFlagSet($flags);
         $page->assign('usage_old', $usage_old);
         $page->assign('alias_old',  $alias_old);
 
@@ -658,6 +668,8 @@ class ProfileModule extends PLModule
         $page->assign('usage_req', $nom_usage);
 
         if (Env::has('submit') && ($nom_usage != $usage_old)) {
+            S::assert_xsrf_token();
+
             // on vient de recevoir une requete, differente de l'ancien nom d'usage
             if ($nom_usage == $nom) {
                 $page->assign('same', true);
@@ -677,7 +689,7 @@ class ProfileModule extends PLModule
     function handler_xnet(&$page)
     {
         $page->changeTpl('profile/groupesx.tpl');
-        $page->assign('xorg_title', 'Polytechnique.org - Promo, Groupes X, Binets');
+        $page->setTitle('Promo, Groupes X, Binets');
 
         $req = XDB::query('
             SELECT m.asso_id, a.nom, diminutif, a.logo IS NOT NULL AS has_logo,
@@ -707,7 +719,7 @@ class ProfileModule extends PLModule
 
     function handler_admin_trombino(&$page, $uid = null, $action = null) {
         $page->changeTpl('profile/admin_trombino.tpl');
-        $page->assign('xorg_title','Polytechnique.org - Administration - Trombino');
+        $page->setTitle('Administration - Trombino');
         $page->assign('uid', $uid);
 
         $q   = XDB::query(
@@ -718,7 +730,6 @@ class ProfileModule extends PLModule
         list($forlife, $promo) = $q->fetchOneRow();
 
         switch ($action) {
-
             case "original":
                 header("Content-type: image/jpeg");
         	readfile("/home/web/trombino/photos".$promo."/".$forlife.".jpg");
@@ -726,6 +737,8 @@ class ProfileModule extends PLModule
         	break;
 
             case "new":
+                S::assert_xsrf_token();
+
                 $data = file_get_contents($_FILES['userfile']['tmp_name']);
             	list($x, $y) = getimagesize($_FILES['userfile']['tmp_name']);
             	$mimetype = substr($_FILES['userfile']['type'], 6);
@@ -736,6 +749,8 @@ class ProfileModule extends PLModule
             	break;
 
             case "delete":
+                S::assert_xsrf_token();
+
                 XDB::execute('DELETE FROM photo WHERE uid = {?}', $uid);
                 break;
         }
@@ -743,7 +758,7 @@ class ProfileModule extends PLModule
         $page->assign('forlife', $forlife);
     }
     function handler_admin_binets(&$page, $action = 'list', $id = null) {
-        $page->assign('xorg_title','Polytechnique.org - Administration - Binets');
+        $page->setTitle('Administration - Binets');
         $page->assign('title', 'Gestion des binets');
         $table_editor = new PLTableEditor('admin/binets', 'binets_def', 'id');
         $table_editor->add_join_table('binets_ins','binet_id',true);
@@ -751,7 +766,7 @@ class ProfileModule extends PLModule
         $table_editor->apply($page, $action, $id);
     }
     function handler_admin_formations(&$page, $action = 'list', $id = null) {
-        $page->assign('xorg_title','Polytechnique.org - Administration - Formations');
+        $page->setTitle('Administration - Formations');
         $page->assign('title', 'Gestion des formations');
         $table_editor = new PLTableEditor('admin/formations','applis_def','id');
         $table_editor->add_join_table('applis_ins','aid',true);
@@ -760,21 +775,21 @@ class ProfileModule extends PLModule
         $table_editor->apply($page, $action, $id);
     }
     function handler_admin_sections(&$page, $action = 'list', $id = null) {
-        $page->assign('xorg_title','Polytechnique.org - Administration - Sections');
+        $page->setTitle('Administration - Sections');
         $page->assign('title', 'Gestion des sections');
         $table_editor = new PLTableEditor('admin/sections','sections','id');
         $table_editor->describe('text','intitulé',true);
         $table_editor->apply($page, $action, $id);
     }
     function handler_admin_ss_secteurs(&$page, $action = 'list', $id = null) {
-        $page->assign('xorg_title', 'Polytechnique.org - Administration - Sous-secteurs');
+        $page->setTitle('Administration - Sous-secteurs');
         $page->assign('title', 'Gestion des sous-secteurs');
         $table_editor = new PLTableEditor('admin/ss_secteurs', 'emploi_ss_secteur', 'id', true);
         $table_editor->describe('label', 'intitulé', true);
         $table_editor->apply($page, $action, $id);
     }
     function handler_admin_fonctions(&$page, $action = 'list', $id = null) {
-        $page->assign('xorg_title', 'Polytechnique.org - Administration - Fonctions');
+        $page->setTitle('Administration - Fonctions');
         $page->assign('title', 'Gestion des fonctions');
         $table_editor = new PLTableEditor('admin/fonctions', 'fonctions_def', 'id', true);
         $table_editor->describe('fonction_fr', 'intitulé', true);
@@ -783,14 +798,14 @@ class ProfileModule extends PLModule
         $table_editor->apply($page, $action, $id);
     }
     function handler_admin_secteurs(&$page, $action = 'list', $id = null) {
-        $page->assign('xorg_title', 'Polytechnique.org - Administration - Secteurs');
+        $page->setTitle('Administration - Secteurs');
         $page->assign('title', 'Gestion des secteurs');
         $table_editor = new PLTableEditor('admin/secteurs', 'emploi_secteur', 'id', true);
         $table_editor->describe('label', 'intitulé', true);
         $table_editor->apply($page, $action, $id);
     }
     function handler_admin_medals(&$page, $action = 'list', $id = null) {
-        $page->assign('xorg_title','Polytechnique.org - Administration - Distinctions');
+        $page->setTitle('Administration - Distinctions');
         $page->assign('title', 'Gestion des Distinctions');
         $table_editor = new PLTableEditor('admin/medals','profile_medals','id');
         $table_editor->describe('text', 'intitulé',  true);